# CVEs published 2022-06-30

101 CVEs were published on June 30, 2022: 10 critical, 11 high. Days are UTC.

- [CVE-2022-32295](https://cve.now/CVE-2022-32295.md): On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the O (no CVSS)
- [CVE-2022-27904](https://cve.now/CVE-2022-27904.md): Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent inst (no CVSS)
- [CVE-2021-32428](https://cve.now/CVE-2021-32428.md): SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author\_ (no CVSS)
- [CVE-2022-32988](https://cve.now/CVE-2022-32988.md): Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3\_805 via the "\*list" parameters (e.g. (no CVSS)
- [CVE-2022-33087](https://cve.now/CVE-2022-33087.md): A stack overflow in the function DM\_ In fillobjbystr() of TP-Link Archer C50&A5(US)\_V5\_200407 allows attackers to cause a Denial of Service (no CVSS)
- [CVE-2022-33085](https://cve.now/CVE-2022-33085.md): ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch\_filename function at \\espcms\_pu (no CVSS)
- [CVE-2022-31115](https://cve.now/CVE-2022-31115.md): Unsafe YAML deserialization in opensearch-ruby (CVSS 8.8, opensearch-project opensearch-ruby · opensearch-ruby)
- [CVE-2022-33082](https://cve.now/CVE-2022-33082.md): An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted i (no CVSS, github.com/open-policy-agent/opa)
- [CVE-2014-0156](https://cve.now/CVE-2014-0156.md): Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argument (no CVSS, awesome\_spawn)
- [CVE-2014-0068](https://cve.now/CVE-2014-0068.md): It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permissi (no CVSS, openshift node-util)
- [CVE-2022-23725](https://cve.now/CVE-2022-23725.md): PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances (CVSS 7.7, Ping Identity PingID Windows Login)
- [CVE-2022-23720](https://cve.now/CVE-2022-23720.md): PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file (CVSS 7.5, Ping Identity PingID Windows Login)
- [CVE-2022-23719](https://cve.now/CVE-2022-23719.md): PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests (CVSS 7.2, Ping Identity PingID Windows Login)
- [CVE-2022-23718](https://cve.now/CVE-2022-23718.md): PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution (CVSS 7.6, Ping Identity PingID Windows Login)
- [CVE-2022-23717](https://cve.now/CVE-2022-23717.md): PingID Windows Login prior to 2.8 denial of service condition (CVSS 5.0, Ping Identity PingID Windows Login)
- [CVE-2021-41995](https://cve.now/CVE-2021-41995.md): PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks (CVSS 7.7, Ping Identity PingID Mac Login)
- [CVE-2022-33329](https://cve.now/CVE-2022-33329.md): Multiple command injection vulnerabilities exist in the web\_server ajax endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33328](https://cve.now/CVE-2022-33328.md): Multiple command injection vulnerabilities exist in the web\_server ajax endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33327](https://cve.now/CVE-2022-33327.md): Multiple command injection vulnerabilities exist in the web\_server ajax endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33326](https://cve.now/CVE-2022-33326.md): Multiple command injection vulnerabilities exist in the web\_server ajax endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33325](https://cve.now/CVE-2022-33325.md): Multiple command injection vulnerabilities exist in the web\_server ajax endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33314](https://cve.now/CVE-2022-33314.md): Multiple command injection vulnerabilities exist in the web\_server action endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33313](https://cve.now/CVE-2022-33313.md): Multiple command injection vulnerabilities exist in the web\_server action endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-33312](https://cve.now/CVE-2022-33312.md): Multiple command injection vulnerabilities exist in the web\_server action endpoints functionalities of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-32585](https://cve.now/CVE-2022-32585.md): A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-28127](https://cve.now/CVE-2022-28127.md): A data removal vulnerability exists in the web\_server /action/remove/ API functionality of Robustel R1510 3.3.0. (CVSS 8.7, Robustel R1510)
- [CVE-2022-2197](https://cve.now/CVE-2022-2197.md): Exemys RME1 (CVSS 9.8, Exemys RME1-AI firmware)
- [CVE-2013-4561](https://cve.now/CVE-2013-4561.md): In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. (no CVSS, openshift-origin-msg-node-mcollective)
- [CVE-2022-34818](https://cve.now/CVE-2022-34818.md): Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing att (no CVSS, Jenkins project Jenkins Failed Job Deactivator Plugin · de.…)
- [CVE-2022-34817](https://cve.now/CVE-2022-34817.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable job (no CVSS, Jenkins project Jenkins Failed Job Deactivator Plugin · de.…)
- [CVE-2022-34816](https://cve.now/CVE-2022-34816.md): Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where (no CVSS, Jenkins project Jenkins HPE Network Virtualization Plugin ·…)
- [CVE-2022-34815](https://cve.now/CVE-2022-34815.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pe (no CVSS, Jenkins project Jenkins Request Rename Or Delete Plugin · o…)
- [CVE-2022-34814](https://cve.now/CVE-2022-34814.md): Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attack (no CVSS, Jenkins project Jenkins Request Rename Or Delete Plugin · o…)
- [CVE-2022-34813](https://cve.now/CVE-2022-34813.md): A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to c (no CVSS, Jenkins project Jenkins XPath Configuration Viewer Plugin ·…)
- [CVE-2022-34812](https://cve.now/CVE-2022-34812.md): A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create (no CVSS, Jenkins project Jenkins XPath Configuration Viewer Plugin ·…)
- [CVE-2022-34811](https://cve.now/CVE-2022-34811.md): A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to a (no CVSS, Jenkins project Jenkins XPath Configuration Viewer Plugin ·…)
- [CVE-2022-34810](https://cve.now/CVE-2022-34810.md): A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti (no CVSS, Jenkins project Jenkins RQM Plugin · net.praqma:rqm-plugin)
- [CVE-2022-34809](https://cve.now/CVE-2022-34809.md): Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be (no CVSS, Jenkins project Jenkins RQM Plugin · net.praqma:rqm-plugin)
- [CVE-2022-34808](https://cve.now/CVE-2022-34808.md): Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller whe (no CVSS, Jenkins project Jenkins Cisco Spark Plugin · org.jenkins-ci…)
- [CVE-2022-34807](https://cve.now/CVE-2022-34807.md): Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller (no CVSS, Jenkins project Jenkins Elasticsearch Query Plugin · org.je…)
- [CVE-2022-34806](https://cve.now/CVE-2022-34806.md): Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be vi (no CVSS, Jenkins project Jenkins Jigomerge Plugin · org.jenkins-ci.p…)
- [CVE-2022-34805](https://cve.now/CVE-2022-34805.md): Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller whe (no CVSS, Jenkins project Jenkins Skype notifier Plugin · org.jenkins…)
- [CVE-2022-34804](https://cve.now/CVE-2022-34804.md): Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configurat (no CVSS, Jenkins project Jenkins OpsGenie Plugin · org.jenkins-ci.pl…)
- [CVE-2022-34803](https://cve.now/CVE-2022-34803.md): Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenk (no CVSS, Jenkins project Jenkins OpsGenie Plugin · org.jenkins-ci.pl…)
- [CVE-2022-34802](https://cve.now/CVE-2022-34802.md): Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration fil (no CVSS, Jenkins project Jenkins RocketChat Notifier Plugin · org.je…)
- [CVE-2022-34801](https://cve.now/CVE-2022-34801.md): Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potent (no CVSS, Jenkins project Jenkins Build Notifications Plugin · tools.…)
- [CVE-2022-34800](https://cve.now/CVE-2022-34800.md): Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller w (no CVSS, Jenkins project Jenkins Build Notifications Plugin · tools.…)
- [CVE-2022-34799](https://cve.now/CVE-2022-34799.md): Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins control (no CVSS, Jenkins project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2022-34798](https://cve.now/CVE-2022-34798.md): Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers wit (no CVSS, Jenkins project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2022-34797](https://cve.now/CVE-2022-34797.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to a (no CVSS, Jenkins project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2022-34796](https://cve.now/CVE-2022-34796.md): A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumer (no CVSS, Jenkins project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2022-34795](https://cve.now/CVE-2022-34795.md): Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a st (no CVSS, Jenkins project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2022-34794](https://cve.now/CVE-2022-34794.md): Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to a (no CVSS, Jenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…)
- [CVE-2022-34793](https://cve.now/CVE-2022-34793.md): Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…)
- [CVE-2022-34792](https://cve.now/CVE-2022-34792.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an at (no CVSS, Jenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…)
- [CVE-2022-34791](https://cve.now/CVE-2022-34791.md): Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a st (no CVSS, Jenkins project Jenkins Validating Email Parameter Plugin ·…)
- [CVE-2022-34790](https://cve.now/CVE-2022-34790.md): Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scr (no CVSS, Jenkins project Jenkins eXtreme Feedback Panel Plugin · org…)
- [CVE-2022-34789](https://cve.now/CVE-2022-34789.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous m (no CVSS, Jenkins project Jenkins Matrix Reloaded Plugin · net.praqma…)
- [CVE-2022-34788](https://cve.now/CVE-2022-34788.md): Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS (no CVSS, Jenkins project Jenkins Matrix Reloaded Plugin · net.praqma…)
- [CVE-2022-34787](https://cve.now/CVE-2022-34787.md): Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2022-34786](https://cve.now/CVE-2022-34786.md): Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross- (no CVSS, Jenkins project Jenkins Rich Text Publisher Plugin · org.je…)
- [CVE-2022-34785](https://cve.now/CVE-2022-34785.md): Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/ (no CVSS, Jenkins project Jenkins build-metrics Plugin · org.jenkins-…)
- [CVE-2022-34784](https://cve.now/CVE-2022-34784.md): Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) (no CVSS, Jenkins project Jenkins build-metrics Plugin · org.jenkins-…)
- [CVE-2022-34783](https://cve.now/CVE-2022-34783.md): Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exp (no CVSS, Jenkins project Jenkins Plot Plugin · org.jenkins-ci.plugin…)
- [CVE-2022-34782](https://cve.now/CVE-2022-34782.md): An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the (no CVSS, Jenkins project Jenkins requests-plugin Plugin · org.jenkin…)
- [CVE-2022-34781](https://cve.now/CVE-2022-34781.md): Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect (no CVSS, Jenkins project Jenkins XebiaLabs XL Release Plugin · com.x…)
- [CVE-2022-34780](https://cve.now/CVE-2022-34780.md): A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to a (no CVSS, Jenkins project Jenkins XebiaLabs XL Release Plugin · com.x…)
- [CVE-2022-34779](https://cve.now/CVE-2022-34779.md): A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumer (no CVSS, Jenkins project Jenkins XebiaLabs XL Release Plugin · com.x…)
- [CVE-2022-34778](https://cve.now/CVE-2022-34778.md): Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test (no CVSS, Jenkins project Jenkins TestNG Results Plugin · org.jenkins…)
- [CVE-2022-34777](https://cve.now/CVE-2022-34777.md): Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resultin (no CVSS, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2013-4144](https://cve.now/CVE-2013-4144.md): There is an object injection vulnerability in swfupload plugin for wordpress. (no CVSS, swfupload wordpress plugin)
- [CVE-2022-22494](https://cve.now/CVE-2022-22494.md): IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type (CVSS 3.7, IBM Spectrum Protect Operations Center)
- [CVE-2022-22472](https://cve.now/CVE-2022-22472.md): IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat Ope (CVSS 6.0, IBM Spectrum Protect Plus)
- [CVE-2021-38954](https://cve.now/CVE-2021-38954.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version informatio (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-38941](https://cve.now/CVE-2021-38941.md): IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information l (CVSS 5.3, IBM Cloud Pak for Multicloud Management Monitoring)
- [CVE-2022-31112](https://cve.now/CVE-2022-31112.md): Protected fields exposed via LiveQuery in parse-server (CVSS 8.2, parse-community parse-server · parse-server)
- [CVE-2022-22496](https://cve.now/CVE-2022-22496.md): While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONS (CVSS 5.3, IBM Spectrum Protect Server)
- [CVE-2022-22487](https://cve.now/CVE-2022-22487.md): An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login (CVSS 5.9, IBM Spectrum Protect Server)
- [CVE-2022-22478](https://cve.now/CVE-2022-22478.md): IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. (CVSS 6.2, IBM Spectrum Protect Client)
- [CVE-2022-22474](https://cve.now/CVE-2022-22474.md): IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP socke (CVSS 5.9, IBM Spectrum Protect Client)
- [CVE-2021-37791](https://cve.now/CVE-2021-37791.md): MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin. (no CVSS)
- [CVE-2022-1955](https://cve.now/CVE-2022-1955.md): Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user d (no CVSS, Session)
- [CVE-2021-37778](https://cve.now/CVE-2021-37778.md): There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution. (no CVSS)
- [CVE-2021-37770](https://cve.now/CVE-2021-37770.md): Nucleus CMS v3.71 is affected by a file upload vulnerability. (no CVSS)
- [CVE-2021-41506](https://cve.now/CVE-2021-41506.md): Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518\_50H10L\_S39 V4.02.R (no CVSS)
- [CVE-2022-1852](https://cve.now/CVE-2022-1852.md): A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86\_emulate\_insn in (no CVSS, kernel · :linux\_kernel:)
- [CVE-2013-4170](https://cve.now/CVE-2013-4170.md): In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. (no CVSS, ember-source)
- [CVE-2022-33043](https://cve.now/CVE-2022-33043.md): A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary (no CVSS)
- [CVE-2021-40663](https://cve.now/CVE-2021-40663.md): deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Polluti (no CVSS, deep.assign)
- [CVE-2021-40643](https://cve.now/CVE-2021-40643.md): EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. (no CVSS)
- [CVE-2022-26135](https://cve.now/CVE-2022-26135.md): A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the si (CVSS 6.5, Atlassian Jira Core Server · Atlassian Jira Software Ser… +3)
- [CVE-2017-20125](https://cve.now/CVE-2017-20125.md): Online Hotel Booking System Pro roomtype-details.php sql injection (CVSS 6.3, Online Hotel Booking System Pro)
- [CVE-2017-20124](https://cve.now/CVE-2017-20124.md): Online Hotel Booking System Pro Plugin roomtype-details.php sql injection (CVSS 6.3, Online Hotel Booking System Pro Plugin)
- [CVE-2017-20123](https://cve.now/CVE-2017-20123.md): Viscosity DLL untrusted search path (CVSS 8.8, Viscosity)
- [CVE-2017-20122](https://cve.now/CVE-2017-20122.md): Bitrix Site Manager Contact Form cross site scripting (CVSS 3.5, Bitrix Site Manager)
- [CVE-2017-20121](https://cve.now/CVE-2017-20121.md): Teradici Management Console Database Management privileges management (CVSS 7.8, Teradici Management Console)
- [CVE-2022-2056](https://cve.now/CVE-2022-2056.md): Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-2057](https://cve.now/CVE-2022-2057.md): Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-2058](https://cve.now/CVE-2022-2058.md): Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-2078](https://cve.now/CVE-2022-2078.md): A vulnerability was found in the Linux kernel's nft\_set\_desc\_concat\_parse() function .This flaw allows an attacker to trigger a buffer overf (no CVSS, kernel)
- [CVE-2022-2257](https://cve.now/CVE-2022-2257.md): Out-of-bounds Read in vim/vim (CVSS 7.8, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.